Made MultiPartParser ignore filenames that normalize to an empty string
to fix crash in MemoryFileUploadHandler on specially crafted user input
(#26325).

Fixed a race condition in BaseCache.get_or_set() (#26332). It
now returns the default value instead of False if there’s an error
when trying to add the value to the cache.

Fixed data loss on SQLite where DurationField values with fractional
seconds could be saved as None (#26324).

The forms in contrib.auth no longer strip trailing and leading whitespace
from the password fields (#26334). The change requires users who set
their password to something with such whitespace after a site updated to
Django 1.9 to reset their password. It provides backwards-compatibility for
earlier versions of Django.